Terraform provider reference / resources / router_wireguard

fiberax_router_wireguard (Resource)

The WireGuard tunnel of a ROUTER. ONE per router; the only thing you set is enabled, everything else (interface, port, subnet, the router's key) is chosen by the platform and read back here - it is what a device needs for its [Peer] section.

Switching the tunnel on for the first time creates it; switching it off stops accepting connections but keeps the router key and the devices, so switching it back on restores them.

The resource has no create and no delete: the tunnel record always exists. Destroying the resource DOES NOT TOUCH the platform - to stop the tunnel, set enabled = false explicitly.

Devices are separate resources (fiberax_router_wireguard_device) and require the tunnel to be enabled: reference this resource from them (depends_on or server_id = fiberax_router_wireguard.x.server_id).

Example Usage

# The WireGuard tunnel of a ROUTER. ONE per router; you only switch it on and off,
# the platform chooses the interface, the port, the subnet and the router key.
resource "fiberax_router_wireguard" "vpn" {
  server_id = fiberax_server.router.id
  enabled   = true
}

# Everything a device needs for its [Peer] section is read back from the tunnel.
output "wireguard_peer" {
  value = {
    public_key  = fiberax_router_wireguard.vpn.public_key
    endpoint    = fiberax_router_wireguard.vpn.endpoint
    allowed_ips = fiberax_router_wireguard.vpn.allowed_ips
    keepalive   = fiberax_router_wireguard.vpn.keepalive
  }
}

Schema

Required

• enabled (Boolean) Whether the tunnel accepts connections. The only field you set.
• server_id (Number) The router. It is also the resource identifier: changing this field means a different router, that is, the resource is recreated.

Read-Only

• allowed_ips (List of String) Ranges a device should route into the tunnel: the router's private networks plus the tunnel subnet.
• configured (Boolean) The platform holds a key and device records for this router. Switching on brings them back.
• device_count (Number) Devices currently recorded.
• device_limit (Number) Maximum devices on this tunnel.
• dns (String) DNS server to use inside the tunnel (the router).
• endpoint (String) Public address and port devices connect to (203.0.113.10:51820).
• interface (String) Interface name inside the router (wg90). Not set while the tunnel is off.
• keepalive (Number) Recommended persistent keepalive, seconds.
• managed (Boolean) The interface on the router matches the platform records. False means someone changed the tunnel inside the router by hand; devices cannot be managed until that is resolved.
• networks (List of String) Private networks of the router reachable through the tunnel.
• port (Number) UDP port the router listens on.
• public_key (String) Public key of the router - the peer key for device configurations.
• router_address (String) Address of the router inside the tunnel.
• subnet (String) Address range of the tunnel; devices get addresses from it.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# The import ID is the router's server ID: the tunnel has no ID of its own.
terraform import fiberax_router_wireguard.vpn 11102

Generated from the provider schema for version 0.3.0. How to install the provider: Terraform provider.